[gnacho]

Two defects found while checking whether third-party CalDAV clients can use the server behind the OpenCloud proxy.

Well-known discovery in -dav-root mode

newHandler returned right after mounting the catch-all DAV handler, so /.well-known/caldav and /.well-known/carddav were only registered in standalone mode. Behind the proxy the request fell into the generic DAV handler, which read the path as /<user>/<collection> and answered 403 dav: access to another user's data is not allowed.

Both routes are now registered before the catch-all, and a test builds the handler with davRoot=true. It fails with the same 403 before the change.

OPTIONS without identity

The OpenCloud proxy does not authenticate OPTIONS, so davcloud received it with no X-Remote-User and answered 401 missing identity, even for correctly authenticated clients. internal/dav answers OPTIONS from a static response (compliance headers plus Allow) that reads no user and no storage, so the identity is not needed there. Every method that touches data still requires it, and a test pins that GET, PROPFIND, REPORT, PUT and DELETE keep returning 401 without identity.

Closes #47
Closes #48

Verification

• go vet ./... clean
• go test ./... green
• Both new tests reproduced their defect before the fix (403 and 401 respectively)